Amendment and Response 

Applicant: N. Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 3 1,2001 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS ^ ^ 

TN THE CLAIMS 

Please cancel claims 2-5, 8, 13, 25-36, 38-41, 43, 45, and 48. 
Please amend claims 1, 6, 7, 9, 1 1, 12, 23, 37, 42, and 44 as follows: 

1 . (Currently Amended) A method for analyzing a stream of network usage data 
comprising: 

generating a statistical model from a set of usage data record events; 
receiving a most recent record event; mi: 

updating the statistical model using the most recent record event by adding the most 
recent record event to the statistical model, wherein an identifier is associated with each 
record event, including updating only a portion of the statistical model associated with the 
identifier^ 

storing the set of record events in a history cache, and wherein if the history cache i s 
fall, updating the statistical model includes removing a least r ecent record event from the 
statistical model: and 

defining the statistical model to include an aggregatio n of each record event set stored 

in the history cache: 

wherein generating a statistical model from the set of record events includes 
generating an aggregation table for tracking an aggregation of record ev ents associated with 
an identifier: and 

wherein the most recent record event is associated with an identifier: and wherein 
updating the statistical model includes updating only t he aggregation of record events in the 
fracking table for that identifier . 

2-5. (Cancelled) 

6. (Currently Amended) The method of claim #1, comprising generating a complex 
statistical model representative of the network data from the aggregation table. 
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7. (Currently Amended) The method of claim comprising generating a histogram 
statistical model representative of the network data from the aggregation table. 

8. (Cancelled) 

9. (Currently Amended) The method of claim further comprising generating a 
complex statistical model from the aggregation table. 

10. (Original) The method of claim 9, further wherein updating the statistical model 
includes updating only a portion of the complex statistical model associated with an 
identifier. 

1 1 . (Currently Amended) The method of claim further comprising generating a 
histogram statistical model from the.aggregation table. 

12. (Currently Amended) The method of claim #i, wherein upon receiving a most recent 
record event the method further comprising replacing the least recent record event stored in 
the history cache with the most recent record event. 

13. (Cancelled) 

14. (Original) The method of claim 1 1, wherein if the history cache is full, updating the 
statistical model further includes removing a least recent record event set associated with a 
least recent update time interval from the statistical model. 

15. (Original) The method of claim 1 1, further comprising defining the statistical model 
to include an aggregation of each record event set stored in the history cache. 
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16. (Original) The method of claim 1 1, wherein the history cache is an array of memory 
segments, wherein the number of memory segments is equal to the number of update time 
intervals in the rolling time interval. 

17. (Original) The method of claim 16, further comprising storing each record event in a 
memory segment in the history cache. 

18. (Origmal) The method of claim 17, further comprising defining an index array 
associated including a set of contiguous index segments, wherein each index segment 
including a pointer to the memory segment storing in the history cache storing the next 
consecutive record event. 

19. (Original) The method of claim 1 8, further defining a first pointer to the index 
segment associated with the memory segment storing the least recent record event. 

20. (Original) The method of claim 19, wherein upon receiving a most recent record 
event the method further comprising replacing the least recent record event stored in the 
history cache with the most recent record event. 

21 . (Original) The method of claim 20, further comprising moving the first pouiter to the 
next contiguous index segment. 

22. (Original) The method of claim 19, further defining a second pointer to the index 
segment associated with the memory segment storing the most recent record event. 

23. (Currently Amended) A method for analyzing a stream of network usage data over a 
rolling time interval comprising: 

defming a statistical model for analyzing the stream of network usage data over the 
rolling time interval; 

defining the rolling time interval to include a plurality of update time intervals; 
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receiving a record event set from the stream of data for each update time interval, 
each record event set including one or more record events, wherein each record event is 
associated with a user identifier; 

storing the record event set for each update interval in a historj' cache; 

generating the statistical model over the rolling time interval using each record event 
stored in the history cache; an^ 

updating only a portion of the statistical model associated with the most recent record 
event for a most recent update time interval; 

defining the statistical model to include an aggregation table having an aggregation 
table entry for tracking an aggregation of each record event set stored in the history cache for 
each user identifier: and 

generating a histogi'am from the aggregation table; 

wherein the step of updating the statistical model includes the step of updating only 
the aggregation table entry associated with the most recent record event: and 

wherein updating the statistical result includes updating only the portion of the 
histogram associated with the aggi-egation table entry associated with the most recent record 
event . 

24. (Previously Presented) The method of claim 23, wherein if the history cache is full, 
updating the statistical model fiirther includes removing a least recent record event set 
associated with a least recent update time interval from the statistical model. 

25-36. (Cancelled) 

37. (Currently Amended) A network usage analysis system for analyzing a stream of 
network usage data comprising: 

a data analysis system server which generates a statistical model from a set of usage 
data record events, and upon receiving a most recent record event, the data analysis system 
server updates the statistical model using the most recent record event by adding the most 
recent record event to the statistical model, wherein customer usage is associated with each 
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record event, including updating only a portion of the statistical model associated with the 
customer usage; 

defining a history cache, wherein the data analysis system server stores the set of 
record events in the history cache, and wherein if the history cache is full, updating the 
statistical model includes removing a least recent record event from the statistical model: and 

defines the statistical model to include an aggregation of each record event set stored 
in the history cache; 

wherein an identifier is associated with each record event, and wherein generating a 
statistical model fi-om the set of record events includes the data analysis system server 
generating an aggi-egation table for tracldng an aggregation of record events associated with 
an identifier: and 

wherein the most recent record event is associated with an identifier: and wherein the 
data analysis system server updating the statistical model includes updating only the 
aggregation of record events in the tracking table for that identifier . 

38-41. (Cancelled) 

42. (Currently Amended) The system of claim -4437, wherein the data analysis system 
server generates a complex statistical model representative of the network data fi-om the 
aggregation table. 

43. (Cancelled) 

44. (Currently Amended) The system of claim-43 -37. fiirther wherein the data analysis 
system server generates a complex statistical model fi-om the aggregation table. 

45. (Cancelled) 

46. (Previously Presented) A method for analyzing a stream of network usage data 
comprising: 
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generating a statistical model from a set of network usage record events; 

receiving a most recent record event; and 
updating tiie statistical model using the most recent record event by adding the most recent 
record event to the statistical model further comprising the steps of: 
storing the set of record events in a history cache; 

wherein if the history cache is full, updating the statistical model includes 
removing a least recent record event from the statistical model, flirther comprising: 

defining the statistical model to include an aggregation of each record 
event set stored in the history cache, wherein an identifier is associated with each record 
event, and wherein generating a statistical model from the set of record events includes 
generating an aggregation table for tracking an aggregation of record events associated with 
an identifier, wherein the most recent record event is associated with an identifier; and 

wherein updating the statistical model includes updating only the aggregation 
of record events in the tracking table for that identifier, flirther comprising generating a 
histogram statistical model ^-om the aggregation table, wherem the history cache is an array 
of memory segments, wherein the number of memory segments is equal to the number of 
update time intervals in the rolling time interval, and storing each record event in a memory 
segment in the history cache, and defining an index array associated with the statistical model 
including a set of contiguous index segments, wherein each index segment includes a pointer 
to the memory segment in the history cache storing the next consecutive record event, flirther 
defining a first pointer to the index segment associated with the memory segment storing the 
least recent record event, wherein upon receiving a most recent record event the method 
replacing the least recent record event stored in the history cache with the most recent record 
event, and flirther moving the first pointer to the next contiguous index segment. 

47. (Previously Presented) The method of claim 46, wherein the histogram statistical 
model includes a first statistical model including a histogram having a first axis illustrating 
total usage defined by a number of bins, each bin having a usage variable range, and a second 
axis defined by a frequency corresponding to a number of users having a total usage within 
the usage variable range of each bin. 
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48. (Cancelled) 
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